You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ak...@apache.org on 2026/06/16 19:54:33 UTC
(tooling-agents) branch main updated: docs: reorganize around RAI
This is an automated email from the ASF dual-hosted git repository.
andrewmusselman pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git
The following commit(s) were added to refs/heads/main by this push:
new 2eae6b3 docs: reorganize around RAI
2eae6b3 is described below
commit 2eae6b3118abc3b3717ca91b33b88c7b7a181757
Author: Andrew Musselman <ak...@apache.org>
AuthorDate: Tue Jun 16 12:54:24 2026 -0700
docs: reorganize around RAI
---
docs/README.md | 28 +++++++---
docs/{gofannon/README.md => platform/gofannon.md} | 0
docs/{ => platform}/vast-ai-openwebui-runbook.md | 0
docs/rai/README.md | 35 ++++++++++++
docs/rai/roadmap/README.md | 31 +++++++++++
docs/rai/roadmap/architecture.md | 65 ++++++++++++++++++++++
docs/rai/roadmap/architecture.svg | 60 ++++++++++++++++++++
docs/roadmap/README.md | 52 -----------------
docs/security-pipeline/README.md | 61 ++++++++++++++++++++
.../asvs-applicability.md | 0
.../eval-framework.md | 0
.../multi-spec-architecture.md | 0
.../results/scorecard-atr-details.md | 0
.../results/scorecard-atr.md | 0
.../specs/api-top-10.md | 0
.../specs/asf-baseline.md | 0
docs/{roadmap => security-pipeline}/specs/asvs.md | 0
.../specs/atr-integration.md | 0
.../specs/cwe-top-25.md | 0
docs/{roadmap => security-pipeline}/specs/slsa.md | 0
docs/{roadmap => security-pipeline}/specs/wstg.md | 0
.../specs/wstg/README.md | 0
.../specs/wstg/build_spec.py | 0
.../specs/wstg/out/wstg-spec-static.json | 0
.../specs/wstg/out/wstg-spec.json | 0
.../specs/wstg/wstg_catalog.py | 0
.../tooling-landscape.md} | 8 +--
27 files changed, 277 insertions(+), 63 deletions(-)
diff --git a/docs/README.md b/docs/README.md
index 1216353..217076c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,17 +1,31 @@
# Documentation
-### [gofannon/](gofannon/)
+## Responsible AI Initiative
-Platform setup and agent development guide for [Gofannon](https://github.com/The-AI-Alliance/gofannon), the agent runtime that powers review pipelines.
+### [rai/](rai/README.md)
-### [tooling/](tooling/)
+What the Responsible AI Initiative is and what it provides to the Foundation and
+its projects.
-Security tooling landscape — comparison of our pipelines with external tools (Scorecard, OSS-CRS, Strix, zizmor, and others), evaluation results, and how they complement each other.
+### [rai/roadmap/](rai/roadmap/README.md)
-### [roadmap/](roadmap/)
+A proposed [platform architecture](rai/roadmap/architecture.md) to support RAI:
+the `llm` gateway, `agents`, `mcp`, and the `advisor` governance layer.
-Where the pipeline is headed: eval framework, ASVS applicability analysis, multi-spec architecture for expanding beyond ASVS, and integration plans for CWE Top 25, API Top 10, ASF Baseline, and SLSA.
+## Supporting
+
+### [security-pipeline/](security-pipeline/README.md)
+
+The security audit pipeline: its roadmap, eval framework, and security-spec
+coverage (ASVS, CWE Top 25, API Top 10, ASF Baseline, SLSA).
+
+### [platform/](platform/)
+
+Setup and runbooks for the systems the platform depends on:
+[Gofannon](platform/gofannon.md) (the agent runtime) and the
+[vast.ai + OpenWebUI runbook](platform/vast-ai-openwebui-runbook.md) (self-hosted
+model serving PoC).
### [how-to-contribute.md](how-to-contribute.md)
-Contributor agreement and guidelines for the tooling-agents project.
\ No newline at end of file
+Contributor agreement and guidelines.
diff --git a/docs/gofannon/README.md b/docs/platform/gofannon.md
similarity index 100%
rename from docs/gofannon/README.md
rename to docs/platform/gofannon.md
diff --git a/docs/vast-ai-openwebui-runbook.md b/docs/platform/vast-ai-openwebui-runbook.md
similarity index 100%
rename from docs/vast-ai-openwebui-runbook.md
rename to docs/platform/vast-ai-openwebui-runbook.md
diff --git a/docs/rai/README.md b/docs/rai/README.md
new file mode 100644
index 0000000..16ea893
--- /dev/null
+++ b/docs/rai/README.md
@@ -0,0 +1,35 @@
+# Responsible AI Initiative
+
+The Responsible AI Initiative (RAI) advances the ASF's mission of building,
+maintaining, and releasing software for the public good in the age of generative
+AI. RAI supports Apache projects and the broader ASF community.
+
+## What RAI provides
+
+- **Access to AI models and tooling** — giving the Foundation and its projects
+ access to language and code models for experimentation and integration across
+ core services including Security, Tooling, and Infrastructure.
+- **Project-level ecosystem support** — helping ASF projects accelerate
+ production-ready AI development with proven, widely adopted technologies across
+ the full AI/ML stack.
+- **Community engagement** — learning, collaboration, and contribution through a
+ Responsible AI track at Community Over Code, hackathons, meetups, and industry
+ events.
+
+## What we're building
+
+The systems are taking shape as project committees:
+
+- an **LLM gateway and model management** layer,
+- **agent harnesses**, and
+- **MCP server frameworks**.
+
+These are the pieces of the platform the [roadmap](roadmap/) lays out, organized
+around a single architecture.
+
+## Where things live
+
+- [roadmap/](roadmap/) — the proposed platform architecture.
+- [../platform/](../platform/) — setup and runbooks for the systems the
+ architecture depends on (agent runtime, self-hosted model serving).
+- [../security-pipeline/](../security-pipeline/) — the security audit pipeline.
diff --git a/docs/rai/roadmap/README.md b/docs/rai/roadmap/README.md
new file mode 100644
index 0000000..705b6bd
--- /dev/null
+++ b/docs/rai/roadmap/README.md
@@ -0,0 +1,31 @@
+# RAI Roadmap
+
+A proposed architecture to support the Responsible AI Initiative: a governed way
+for Apache projects to use language models, agents, and tools, with the catalog,
+metrics, and routing intelligence to keep it accountable.
+
+## The architecture
+
+See [architecture.md](architecture.md) for the full description; in brief:
+
+- **Clients** — the 200+ Apache projects that consume the platform.
+- **Services** — `agents`, `mcp`, and the `llm` gateway that all model calls
+ funnel through.
+- **Models** — first-party, Bedrock, and ASF-hosted backends.
+- **Advisor** — the catalog, metrics, and routing decisions that make the
+ platform governed and observable.
+
+
+
+The proposal names three project committees — **LLM gateway and model
+management**, **agent harnesses**, and **MCP server frameworks** — which map
+directly onto the `llm`, `agents`, and `mcp` boxes above, with `advisor` as the
+cross-cutting governance layer.
+
+## Related
+
+- [../README.md](../README.md) — what RAI is.
+- [../../platform/](../../platform/) — runbooks for the agent runtime and
+ self-hosted model serving the architecture depends on.
+- [../../security-pipeline/](../../security-pipeline/) — the security audit
+ pipeline.
diff --git a/docs/rai/roadmap/architecture.md b/docs/rai/roadmap/architecture.md
new file mode 100644
index 0000000..2edf337
--- /dev/null
+++ b/docs/rai/roadmap/architecture.md
@@ -0,0 +1,65 @@
+# Platform Architecture
+
+A foundation-level platform that gives Apache projects governed access to language
+models, agents, and tools. Projects are clients at the top; a **services** layer
+handles their requests; an **advisor** layer underneath provides the catalog,
+metrics, and routing intelligence that keeps the platform governed and observable.
+
+## At a glance
+
+
+
+Solid arrows are **requests** (and their responses); the dashed arrow is **log
+consumption**.
+
+## The layers
+
+**Clients — the 200+ Apache projects.** Every project is a consumer of the
+platform. They make requests into the services layer and get responses back. A
+project can also reach `llm` directly when it just needs a model, without going
+through agents or tools.
+
+**Services — agents, mcp, and llm.** The request-handling layer:
+
+- `agents` — agentic workflows a project runs. An agent can call tools (`mcp`)
+ and can call models (`llm`) directly.
+- `mcp` — Model Context Protocol tool/server management. Tool invocations that
+ need a model call `llm` in turn.
+- `llm` — the governed gateway for all model calls. Every path that touches a
+ model funnels through here, which is what makes the platform meterable and
+ governable.
+
+Model traffic reaches `llm` several ways — from a client, from an agent, or via an
+`mcp` tool — but it always ends at `llm` before reaching a model.
+
+**Models — where llm sends calls.** The `llm` service routes outward to three
+classes of backend:
+
+- `first-party` — external provider APIs (OpenAI, Anthropic, and similar).
+- `bedrock` — models served through AWS Bedrock.
+- `asf-hosted` — open-weight models the foundation runs on its own infrastructure.
+
+**Advisor — the governance and intelligence layer.** Sits beneath services and
+provides three things:
+
+- `catalog` — the registry of approved models with their licensing, openness, and
+ provenance metadata.
+- `metrics` — usage, cost, latency, and other observability data.
+- `routing decisions` — the policy that informs which model a request should go to.
+
+Advisor relates to services two ways: it **consumes logs** from the services layer
+(the dashed edge) to populate metrics and inform routing, and it **answers
+requests** from services (the solid two-way edge) — for example, `llm` reading the
+catalog or asking for a routing decision.
+
+## Why it's shaped this way
+
+The platform separates **handling requests** (services) from **governing them**
+(advisor). Services stay focused on doing the work; advisor owns the catalog,
+metrics, and routing intelligence as a distinct concern. Because every model call
+funnels through `llm`, the foundation gets one place to meter, govern, and route —
+without forcing projects to change how they call agents or tools.
+
+This is also why the platform stays **vendor-neutral**: the `llm` gateway and the
+`models` layer behind it mean no single provider is load-bearing, and projects
+keep their freedom to choose.
diff --git a/docs/rai/roadmap/architecture.svg b/docs/rai/roadmap/architecture.svg
new file mode 100644
index 0000000..bfba6c6
--- /dev/null
+++ b/docs/rai/roadmap/architecture.svg
@@ -0,0 +1,60 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="100%" viewBox="0 0 680 680" role="img" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif">
+<title>ASF AI platform architecture</title>
+<desc>Apache projects are clients at the top. A services box holds agents and mcp on the left and an llm gateway. Agents and mcp reach llm; agents also call mcp. llm points right to models split into first-party, Bedrock, and ASF-hosted. Advisor at the bottom holds catalog, metrics, and routing decisions, exchanging requests with services and consuming their logs. Solid arrows are requests; dashed arrows are log consumption.</desc>
+<defs>
+<marker id="ar" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse"><path d="M2 1L8 5L2 9" fill="none" stroke="#6b6a64" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></marker>
+</defs>
+
+<text font-size="12" fill="#888780" x="40" y="26">Clients</text>
+<rect x="40" y="34" width="600" height="48" rx="8" fill="#E6F1FB" stroke="#185FA5" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="340" y="62" text-anchor="middle" fill="#0C447C">200+ Apache projects</text>
+
+<line x1="340" y1="86" x2="340" y2="126" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-start="url(#ar)" marker-end="url(#ar)"/>
+
+<text font-size="12" fill="#888780" x="40" y="122">Services</text>
+<rect x="40" y="130" width="430" height="172" rx="12" fill="#EFEEFB" stroke="#534AB7" stroke-width="1"/>
+
+<rect x="64" y="158" width="150" height="44" rx="8" fill="#E1F5EE" stroke="#0F6E56" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="139" y="184" text-anchor="middle" fill="#085041">agents</text>
+
+<rect x="64" y="232" width="150" height="44" rx="8" fill="#E1F5EE" stroke="#0F6E56" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="139" y="258" text-anchor="middle" fill="#085041">mcp</text>
+
+<rect x="296" y="190" width="150" height="52" rx="8" fill="#FAECE7" stroke="#993C1D" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="371" y="220" text-anchor="middle" fill="#712B13">llm</text>
+
+<line x1="139" y1="202" x2="139" y2="230" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-end="url(#ar)"/>
+<line x1="214" y1="178" x2="294" y2="204" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-end="url(#ar)"/>
+<line x1="214" y1="256" x2="294" y2="230" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-end="url(#ar)"/>
+
+<text font-size="12" fill="#888780" x="502" y="122">Models</text>
+<rect x="502" y="130" width="138" height="172" rx="10" fill="#F1EFE8" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="571" y="156" text-anchor="middle" fill="#2C2C2A">models</text>
+<rect x="516" y="180" width="110" height="30" rx="4" fill="#D9D7CD" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="12" x="571" y="200" text-anchor="middle" fill="#2C2C2A">first-party</text>
+<rect x="516" y="216" width="110" height="30" rx="4" fill="#D9D7CD" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="12" x="571" y="236" text-anchor="middle" fill="#2C2C2A">bedrock</text>
+<rect x="516" y="252" width="110" height="30" rx="4" fill="#D9D7CD" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="12" x="571" y="272" text-anchor="middle" fill="#2C2C2A">asf-hosted</text>
+
+<line x1="446" y1="216" x2="500" y2="216" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-end="url(#ar)"/>
+
+<line x1="285" y1="302" x2="285" y2="440" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-start="url(#ar)" marker-end="url(#ar)"/>
+<line x1="400" y1="440" x2="400" y2="302" stroke="#6b6a64" stroke-width="1" fill="none" stroke-dasharray="5 4" marker-end="url(#ar)"/>
+
+<text font-size="12" fill="#888780" x="40" y="434">Advisor</text>
+<rect x="40" y="442" width="600" height="130" rx="10" fill="#FAEEDA" stroke="#854F0B" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="340" y="466" text-anchor="middle" fill="#633806">advisor</text>
+<rect x="64" y="486" width="180" height="64" rx="8" fill="#F1EFE8" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="154" y="510" text-anchor="middle" fill="#2C2C2A">catalog</text>
+<text font-size="12" x="154" y="530" text-anchor="middle" fill="#5F5E5A">models and metadata</text>
+<rect x="250" y="486" width="180" height="64" rx="8" fill="#F1EFE8" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="340" y="522" text-anchor="middle" fill="#2C2C2A">metrics</text>
+<rect x="436" y="486" width="180" height="64" rx="8" fill="#F1EFE8" stroke="#5F5E5A" stroke-width="1"/>
+<text font-size="14" font-weight="500" x="526" y="522" text-anchor="middle" fill="#2C2C2A">routing decisions</text>
+
+<line x1="300" y1="616" x2="340" y2="616" stroke="#6b6a64" stroke-width="1.5" fill="none" marker-end="url(#ar)"/>
+<text font-size="12" x="348" y="620" fill="#888780">requests</text>
+<line x1="300" y1="640" x2="340" y2="640" stroke="#6b6a64" stroke-width="1" fill="none" stroke-dasharray="5 4" marker-end="url(#ar)"/>
+<text font-size="12" x="348" y="644" fill="#888780">log consumption</text>
+</svg>
diff --git a/docs/roadmap/README.md b/docs/roadmap/README.md
deleted file mode 100644
index c45e4ad..0000000
--- a/docs/roadmap/README.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# Security Pipeline Roadmap
-
-Planning documents for the security audit pipeline — where it's headed, how we'll get there, and how we'll know it's working.
-
-For the current pipeline and how to use it, see the [ASVS pipeline documentation](../../ASVS/README.md). For a comparison of external tools in this space, see [tooling](../tooling/).
-
-## Contents
-
-### [ASVS Applicability](asvs-applicability.md)
-
-Where ASVS fits (web apps like ATR and Steve) and where it doesn't (libraries, backend services, infrastructure). Includes a chapter-by-chapter breakdown of applicability by project type, alternative standards for non-web projects, and guidance on how to frame the pipeline when offering it to ASF projects.
-
-### [Eval Framework](eval-framework.md)
-
-Test harness design for measuring pipeline quality and operating at scale. Covers fixtures (known codebases with known vulns), metrics (recall, precision, false positive rate), LLM-as-judge for semantic comparison, auto-filed GitHub issues for novel errors, and operational dashboards. The ATR da901ba L1+L2 run serves as the regression baseline.
-
-### [Multi-Spec Architecture](multi-spec-architecture.md)
-
-Implementation plan for Phase 0: renaming the pipeline from ASVS to security, making agents spec-agnostic, adding the `spec` input parameter, data store schema per spec, spec selection modes, cross-spec deduplication, and migration path. This is the prerequisite for all spec additions below.
-
-### [How tooling-agents Complements ATR](specs/atr-integration.md)
-
-How every tool in the tooling-agents portfolio — ASVS audit, GHA Review, ASF Baseline, and SLSA — fills gaps that ATR can't cover, and how ATR covers the distribution layer that tooling-agents doesn't address. The three-layer model: source/CI security → build integrity → release verification.
-
-### Multi-Spec Expansion
-
-The pipeline currently audits against OWASP ASVS only. These plans extend it to additional security specifications, with automatic spec selection based on project type.
-
-| Phase | Spec | Best For | Effort | Plan |
-|---|---|---|---|---|
-| **Done** | [OWASP ASVS v5.0.0](specs/asvs.md) | Web applications | Complete | In production — ATR and Steve audited |
-| **0** | [Rename ASVS → security](multi-spec-architecture.md) | All | 4 days | Agent renames, `spec` input, cross-spec dedup |
-| **1** | [CWE Top 25](specs/cwe-top-25.md) | Libraries, any code | ~5 days | Memory safety, injection, race conditions |
-| **1** | [OWASP API Top 10](specs/api-top-10.md) | API-heavy projects | ~2.5 days | IDOR, mass assignment, rate limiting |
-| **2** | [ASF Security Baseline](specs/asf-baseline.md) | All ASF projects | ~6 days + review | Release signing, license compliance, ASF auth patterns |
-| **2** | [SLSA Build Levels](specs/slsa.md) | Publishing projects | ~6 days | Provenance, reproducibility, artifact signing |
-| **3** | Community-contributed | Any | Ongoing | Load requirements into data store, no code changes |
-
-After [Phase 0](multi-spec-architecture.md), adding a new spec requires no agent code changes — just requirements in the data store, an optional prompt template, and an update to the discovery agent's project type mapping.
-
-### How Specs Combine
-
-The discovery agent classifies the project and recommends specs:
-
-| Project Type | Recommended Specs |
-|---|---|
-| Web app (ATR, Steve, Superset) | ASVS + API Top 10 + ASF Baseline |
-| Library (Commons, Arrow, Parquet) | CWE Top 25 + ASF Baseline |
-| API service (Solr, CouchDB) | ASVS + API Top 10 + CWE Top 25 + ASF Baseline |
-| Publishing project (Kafka, Airflow) | All of the above + SLSA |
-
-The consolidator deduplicates across specs using cross-references — when ASVS 1.2.1 and CWE-79 flag the same XSS issue, the consolidated report merges them and notes both specs.
\ No newline at end of file
diff --git a/docs/security-pipeline/README.md b/docs/security-pipeline/README.md
new file mode 100644
index 0000000..2a8f45e
--- /dev/null
+++ b/docs/security-pipeline/README.md
@@ -0,0 +1,61 @@
+# Security Pipeline
+
+The security audit pipeline ingests a codebase, assesses it, and triages
+vulnerabilities using LLMs, producing consolidated findings and GitHub issues. It
+began under ASF Security and scales with Tooling support, and relates to the
+broader [Responsible AI Initiative](../rai/README.md).
+
+This section is the pipeline's roadmap and reference: where it's headed, how it's
+evaluated, and which security specifications it covers.
+
+## Roadmap
+
+### [ASVS applicability](asvs-applicability.md)
+
+Where ASVS fits (web apps like ATR and Steve) and where it doesn't (libraries,
+backend services, infrastructure) — a chapter-by-chapter breakdown by project
+type, alternative standards for non-web projects, and how to frame the pipeline
+when offering it to ASF projects.
+
+### [Eval framework](eval-framework.md)
+
+Test harness for measuring pipeline quality at scale: fixtures, metrics (recall,
+precision, false positive rate), LLM-as-judge for semantic comparison, auto-filed
+issues for novel errors, and operational dashboards. The ATR da901ba L1+L2 run is
+the regression baseline.
+
+### [Multi-spec architecture](multi-spec-architecture.md)
+
+Implementation plan for making the pipeline spec-agnostic: the `spec` input
+parameter, per-spec data store schema, spec selection modes, and cross-spec
+deduplication. This is the prerequisite for every spec addition below.
+
+## Spec coverage
+
+The pipeline audits against a growing set of security specifications, with
+automatic spec selection based on project type.
+
+| Status | Spec | Best for |
+|---|---|---|
+| In production | [OWASP ASVS v5.0.0](specs/asvs.md) | Web applications |
+| Planned | [CWE Top 25](specs/cwe-top-25.md) | Libraries, any code |
+| Planned | [OWASP API Top 10](specs/api-top-10.md) | API-heavy projects |
+| Planned | [ASF Security Baseline](specs/asf-baseline.md) | All ASF projects |
+| Planned | [SLSA build levels](specs/slsa.md) | Publishing projects |
+| Reference | [WSTG](specs/wstg.md) | Web security testing guide |
+
+After the multi-spec work, adding a spec requires no agent code changes — just
+requirements in the data store, an optional prompt template, and a discovery-agent
+mapping update.
+
+### [How tooling-agents complements ATR](specs/atr-integration.md)
+
+How the portfolio — ASVS audit, GHA review, ASF Baseline, SLSA — fills gaps ATR
+can't cover, and how ATR covers the distribution layer the pipeline doesn't: the
+three-layer model of source/CI security, build integrity, and release
+verification.
+
+## Reference
+
+- [Tooling landscape](tooling-landscape.md) — how the pipeline compares to and
+ complements external tools (Scorecard, OSS-CRS, Strix, zizmor, and others).
diff --git a/docs/roadmap/asvs-applicability.md b/docs/security-pipeline/asvs-applicability.md
similarity index 100%
rename from docs/roadmap/asvs-applicability.md
rename to docs/security-pipeline/asvs-applicability.md
diff --git a/docs/roadmap/eval-framework.md b/docs/security-pipeline/eval-framework.md
similarity index 100%
rename from docs/roadmap/eval-framework.md
rename to docs/security-pipeline/eval-framework.md
diff --git a/docs/roadmap/multi-spec-architecture.md b/docs/security-pipeline/multi-spec-architecture.md
similarity index 100%
rename from docs/roadmap/multi-spec-architecture.md
rename to docs/security-pipeline/multi-spec-architecture.md
diff --git a/docs/tooling/results/scorecard-atr-details.md b/docs/security-pipeline/results/scorecard-atr-details.md
similarity index 100%
rename from docs/tooling/results/scorecard-atr-details.md
rename to docs/security-pipeline/results/scorecard-atr-details.md
diff --git a/docs/tooling/results/scorecard-atr.md b/docs/security-pipeline/results/scorecard-atr.md
similarity index 100%
rename from docs/tooling/results/scorecard-atr.md
rename to docs/security-pipeline/results/scorecard-atr.md
diff --git a/docs/roadmap/specs/api-top-10.md b/docs/security-pipeline/specs/api-top-10.md
similarity index 100%
rename from docs/roadmap/specs/api-top-10.md
rename to docs/security-pipeline/specs/api-top-10.md
diff --git a/docs/roadmap/specs/asf-baseline.md b/docs/security-pipeline/specs/asf-baseline.md
similarity index 100%
rename from docs/roadmap/specs/asf-baseline.md
rename to docs/security-pipeline/specs/asf-baseline.md
diff --git a/docs/roadmap/specs/asvs.md b/docs/security-pipeline/specs/asvs.md
similarity index 100%
rename from docs/roadmap/specs/asvs.md
rename to docs/security-pipeline/specs/asvs.md
diff --git a/docs/roadmap/specs/atr-integration.md b/docs/security-pipeline/specs/atr-integration.md
similarity index 100%
rename from docs/roadmap/specs/atr-integration.md
rename to docs/security-pipeline/specs/atr-integration.md
diff --git a/docs/roadmap/specs/cwe-top-25.md b/docs/security-pipeline/specs/cwe-top-25.md
similarity index 100%
rename from docs/roadmap/specs/cwe-top-25.md
rename to docs/security-pipeline/specs/cwe-top-25.md
diff --git a/docs/roadmap/specs/slsa.md b/docs/security-pipeline/specs/slsa.md
similarity index 100%
rename from docs/roadmap/specs/slsa.md
rename to docs/security-pipeline/specs/slsa.md
diff --git a/docs/roadmap/specs/wstg.md b/docs/security-pipeline/specs/wstg.md
similarity index 100%
rename from docs/roadmap/specs/wstg.md
rename to docs/security-pipeline/specs/wstg.md
diff --git a/docs/roadmap/specs/wstg/README.md b/docs/security-pipeline/specs/wstg/README.md
similarity index 100%
rename from docs/roadmap/specs/wstg/README.md
rename to docs/security-pipeline/specs/wstg/README.md
diff --git a/docs/roadmap/specs/wstg/build_spec.py b/docs/security-pipeline/specs/wstg/build_spec.py
similarity index 100%
rename from docs/roadmap/specs/wstg/build_spec.py
rename to docs/security-pipeline/specs/wstg/build_spec.py
diff --git a/docs/roadmap/specs/wstg/out/wstg-spec-static.json b/docs/security-pipeline/specs/wstg/out/wstg-spec-static.json
similarity index 100%
rename from docs/roadmap/specs/wstg/out/wstg-spec-static.json
rename to docs/security-pipeline/specs/wstg/out/wstg-spec-static.json
diff --git a/docs/roadmap/specs/wstg/out/wstg-spec.json b/docs/security-pipeline/specs/wstg/out/wstg-spec.json
similarity index 100%
rename from docs/roadmap/specs/wstg/out/wstg-spec.json
rename to docs/security-pipeline/specs/wstg/out/wstg-spec.json
diff --git a/docs/roadmap/specs/wstg/wstg_catalog.py b/docs/security-pipeline/specs/wstg/wstg_catalog.py
similarity index 100%
rename from docs/roadmap/specs/wstg/wstg_catalog.py
rename to docs/security-pipeline/specs/wstg/wstg_catalog.py
diff --git a/docs/tooling/README.md b/docs/security-pipeline/tooling-landscape.md
similarity index 95%
rename from docs/tooling/README.md
rename to docs/security-pipeline/tooling-landscape.md
index 274cd27..2f3f1f9 100644
--- a/docs/tooling/README.md
+++ b/docs/security-pipeline/tooling-landscape.md
@@ -4,7 +4,7 @@ Research and evaluation of automated security tooling for open source projects.
## Tooling-Agents Pipelines
-The Tooling team maintains two pipelines, both running on the [Gofannon](../gofannon/) agent platform:
+The Tooling team maintains two pipelines, both running on the [Gofannon](../platform/gofannon.md) agent platform:
**ASVS Security Audit Pipeline** ([ASVS/](../../ASVS/)) — LLM-driven code analysis against OWASP ASVS v5.0.0 requirements. Uses architecture-aware domain scoping to audit 345 requirements across 3 levels. Produces per-requirement reports, consolidated findings, and GitHub issues. In production, piloted on ATR and Apache Steve.
@@ -67,9 +67,9 @@ The Tooling team maintains two pipelines, both running on the [Gofannon](../gofa
## Links
-- [ASVS Applicability Study](../roadmap/asvs-applicability.md) — where ASVS fits (web apps) and where it doesn't (libraries, backend services)
-- [Eval Framework](../roadmap/eval-framework.md) — test harness, fixtures, metrics, and operational error handling at scale
-- [Multi-Spec Roadmap](../roadmap/) — expanding the pipeline beyond ASVS to CWE Top 25, API Top 10, ASF Baseline, and SLSA
+- [ASVS Applicability Study](asvs-applicability.md) — where ASVS fits (web apps) and where it doesn't (libraries, backend services)
+- [Eval Framework](eval-framework.md) — test harness, fixtures, metrics, and operational error handling at scale
+- [Multi-Spec Roadmap]() — expanding the pipeline beyond ASVS to CWE Top 25, API Top 10, ASF Baseline, and SLSA
- [OWASP ASVS v5.0.0 PDF](https://github.com/OWASP/ASVS/blob/v5.0.0/5.0/OWASP_Application_Security_Verification_Standard_5.0.0_en.pdf)
- [OpenSSF Scorecard documentation](https://github.com/ossf/scorecard)
- [OSS-CRS paper](https://arxiv.org/abs/2603.08566)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org